Today I hiked in Old Hill Village on the west side of the Pemigewasset River. I worked Macedonia, Italy and W0RW pedestrian mobile in Colorado. This was a fantastic outing.

Coming down the hill alongside Needle Shop Brook, there was still snow and ice. But once in the old village, the road was dry. This is the most amazing spot with 3500 acres of fields and trees which form a flood control reserve for the Franklin Falls Dam. After walking 1/2 mile north I turned east through a field toward the river.

Imagine having a place like this… all to yourself… to roam, to breathe clean air, to enjoy nature… and to play radio.

I setup at the edge of the field, not 60 feet from the river. I tossed a line over a pine branch and sat down in the warm sun. I hooked up the HB-1B with 4 watts on 20 meters to a half-wave wire rising straight from the backpack to the branch overhead.

At the bottom of the band I heard Jane Z320G from Macedonia calling CQ. I answered and we exchanged quick 599s. This was generous because I had to send my call several times before he copied. There was strong QSB. Next I went up the band and heard Pietro IZ2EWR finishing another QSO. The Italian station was very strong and well worth waiting for. Pietro gave me a 579 and sent, “UR QRP FB.”

Before calling it quits, I dialed up to the QRP frequency, 14.060. What a nice surprise to hear Paul W0RW calling CQ. Paul in Colorado, was pedestrian mobile. We were both weak to each other, but were able to complete a contact. Paul gave me a 339 and he was 449.

With cool temperatures in the mid-30s and a wind gusting to 15 MPH, it was a bit nippy in the shade. But in the warm sun, surrounded by blue sky and some trees for a wind-break, it was perfect. This is a place I love to ride my bike in the warmer weather. I’ll be back many times in the glorious weeks ahead.

I have it on good authority, that there will be a new ARRL sponsored challenge coming this spring.  The MacGuyver Challenge (as it is being

ngg – flickr

referred to) will judge the builders’ abilities in creating a 1 Watt or higher 40M CW transmitter, using the highest percentage of household items possible.  The word is that the prize may already be claimed by junkbox-king Kyle Scrapschen, KB2CRP, who was showing his self titled “Junk Drawer Rig” at this year’s Mohawk Valley Hamfest in Sprakers, NY.  Using 17 antique twist-ties, an engraved spork, a lump of some crystallized kitchen-matter, and vintage Mattel Speak-and-Spell, Kyle claims to have had a QSO with a ham aboard a spam-fishing trawler off the coast of  Gough Island!

In other news, it’s April 1st.  Have a great one folks.  I was going to post a story about actually receiving my Xiegu X1M, but that’s NOT funny.

–Neil W2NDG

Hanz W1JSB and I hiked down to a beautiful point on the Pemigewasset River in Bristol. We worked England, Germany, Ohio and Tennessee. It seemed like the first really warm day of spring.

We were hoping to hike to Sky Pond, but there was just too much snow… at least a foot. So we changed plans. We headed to Bristol to a spot where Profile Brook flows into the Pemi. We hiked down the old Northern Railroad right-of-way.

We crossed a few snowy spots and a few muddy places, but it was grand… 52F and sunny! We sat down right on an old stone railroad bridge abutment. We tossed a line high into a nearby ash tree and pulled up a half wave wire for 20 meters. We used the Chinese HB-1B. The band wasn’t full of DX, but we snagged a few. I took the first turn and called my old friend Tom, G3HGE in England as he finished up a QSO. He was strong to me… 599, but there was also significant QSB. He dropped as low as 569. He gave me a generous 549. I’m sure he was unable to copy at times. “DX is below par,” he sent. I told him I’d send some photos of our operating spot. He was pleased with the idea… “That will put flesh on the skeleton,” he sent, and we signed.

Next I called Serg, DL1DGS. I had worked him just yesterday from the shack. He was also strong, but only gave me a 539. Even so, he sent, “UR 4W OK.” With that I handed the key to Hanz.

Next I called Serg, DL1DGS. I had worked him just yesterday from the shack. He was also strong, but only gave me a 539. Even so, he sent, “UR 4W OK.” With that I handed the key to Hanz.

With four QSOs under our belts, we headed back. We went straight to the river through the woods and walked back by a different route. What a pleasure to walk on almost-dry land for the first time in four months.

—-

For a version of this story with imbedded video see http://www.w1pid.com/easter/easter.html

Today I hiked along the Winnipesaukee River. I worked Sweden, Slovenia and Russia. What a great hike!

It’s a perfect spring day… 45F and the snow is melting! I hiked on the old rail right-of-way along the Winnipesaukee River. The river flows from Lake Winnipesaukee in Laconia to the Merrimack River in Franklin. The trail passes through some beautiful farm land.

After about a mile I turned north toward the river. A piece of land juts out into the river. I setup on a large rock with a fantastic view. I’m using an HB-1B on 20 meters with a half-wave wire.

I’m looking toward the east… that seems to be where the signals are coming from too. My first contact is with Steve SM4OTI in Sweden. He gives me a 599 and sends “HI” when I tell him I am running 4 watts. He’s running a KW to a 4 element beam. “UR doing FB WID 4W,” he sends. Of course, he is very strong to me. I’ve worked Steve nearly a dozen times over the years.

I move up the band a bit and answer S57KW. Jure in Slovenia doesn’t get my call sign on the first try, but he gives me a 559 report. “UR 4W QRP doing good job,” he sends.

Finally, I work Vlad RU6AV near Moscow. He gives me a 579. When I tell him I am running 4W /P, he asks about my antenna. I tell him it’s a 10 meter wire. “FB CONDX HI… UR 4W FB Jim.” Then he tells me he is running 200 watts to a 3 element yagi.

I have been operating for only 10 minutes. It’s exhilarating! A beautiful spring day… glorious river scenery and some nice DX for icing on the cake.

My view to the west is perfect. Hopefully we’re seeing the last of the snow. I’ll hike more often now that the days are getting warmer.

This afternoon I walked down to the Pemigewasset River and worked Italy and Germany.

There’s a steep hillside trail leading into the Corps of Engineers flood control area along the river. In the winter the trail is used mostly by snowmobiles. Today the trail is covered with several inches of snow… the remnants from a snow storm last week. It’s sunny with a brilliant blue sky. The temperature is 42F.

At the bottom of the hill, the trail crosses a lovely brook which feeds into the Pemi. Only a couple of weeks ago it was frozen solid. Now it’s flowing again.

I walk about a mile and come to a spot overlooking Shaw Cove. As the trail rounds a sharp corner, the warm sun has
melted the snow along the edge. It’s a good place to sit and there are some tall pine trees lining the trail.

I toss a half wave wire over a branch and set up the HB-1B on 20 meters. The band is active.

Right away I hear IK2CIO, Vini calling CQ. We quickly exchange 599s and send 73. I tell Vini I am running 4W and he confirms the contact.

I tune down the band a bit and hear Holger, DK4LX just finishing a QSO. I call him and he answers giving me a 439. He says he’s in a rush and apologizes for not chatting. I thank him for his answer and tell him I am running 4 watts. He wants to know more… my QTH, the rig… and the antenna. He copies all the information and congratulates me on the setup. He wishes me good luck and I tell him I will send some photos of my location.

I’ve only operated for about 10 minutes, but my tiny signal has reached Europe, and I am thrilled to have a beautiful hike and witness the magic of radio once again. I pack up and hike up the hill.

While I was searching around for information for the UV5R hacking I have previously done, I came across some schematics for the UV3R. From a first glance it looked like the CPU could be flashed. In fact, in the schematics it looked like they even left the programming pads on the PCB. The UV3R is very similar to the UV5R, except for its lower power and lack of a good LCD and a keypad. Other then that, the two radios have the same RDA1846 chip that is controlled by a CPU.

The CPU used on the UV3R is the MC81F8616 which is capable of being re-flashed many times. Better still, the manufacture of the the chip Abov has all the documentations, the compilers and the programmers for this chip.

Chip Documentation (MC81F8616):
http://www.abov.co.kr/eng/product/info/view.php?dev=mc81f8816
C Compiler: http://www.abov.co.kr/eng/tool/hms800_cc.php

This got me very encouraged since it would be much simpler to hack this radio then removing the CPU on the UV5R; I attempted before. I quickly ordered one, took it apart as soon as it arrived and traced the programming pads (I did not even use, just turn it on to make sure its not DOA).

After looking at the datasheets and their USB programmer program, I was able to trace the protocol and re flash the chip using an arduino. As expected, they had the security bit set, so I could not read the original firmware. However, I was able to erase the chip and upload new code. Fortunately it was not too difficult to figure out how everything functions thanks for the schematics and my previous experience hacking the uv5r. My biggest problem was getting the LCD to function properly since it was a bit mislabeled in the schematics.

As a proof of concept I had the radio tuned to 145.525MHz and listens to a signal. When a strong signal is received it played back 3 dtmf tones as can be seen in the video below.

Anyone is welcome to help and you can start by checking out the code from here:

https://github.com/lelazary/UV3RMod

I also started a thread on the UV3R yahoo groups for anyone wanting to pitch in ideas for the firmware (given the limitations of the RDA1846 chip and 16K of memory). I am not going to promise to implement everything, but if its not to difficult, I will try to. However, since this is going to be open source firmware, you could always try to change it yourself (I will always be willing to help).

Here are my list (if the feature makes it to the repository at
https://github.com/lelazary/UV3RMod/blob/master/WISHLIST
then it would probably be implemented):

Mode 1) Quick interface to program rx freq, tx freq, power and PL code very quickly for repeaters. No offset, you just start with the rx freq and shift it by whichever amount you want. This will allow allow you to turn off the tx, or operate satellites.
At any point during this mode, you can hold the mem channel and it will ask you which number you want to save this to.

Mode 2) Memory mode will allow you to go through your saved memory. At any point you can press menu and change more details about the channel.  The details will include power with granular level, DTMF TX/RX, and other functions TBD. This mode will show the channel name and the freq underneath it.

Mode 4) Satellite Mode: Auto tuning of the frequency with response to the Doppler shift.

Mode 5) Digital mode. Hopefully I could add some text base digital data for rx and tx. You might need to tx the text using morse code since there is no alpha numeric keypad on the radio. The digital mode will also include a store and repeat message forwarding.

Mode 6) Computer mode: All the functions of the radio including the RDA1846 registers, TX, and RX will be controlled through the serial port on the radio.

Mode 7) Fox/Hunt  mode. Can be used to transmit a signal intermittently (like call sign morse code). Or send the RSSI signal into the audio, and with a directional antenna you can go hunting.

Mode 8) Advance mode: Any RDA 1846 register can be set manually and saved for during startup.

Mode 9) If the digital mode works, then RF programming of the radio. This will allow anyone to send you repeater information from their memory locations. I will work by selecting a memory channel to rx, and pressing a button. Then on another radio you can send the programming info.

Programmer Protocol

The implementation of this protocol along with the arduino code and the ongoing firmware can be cloned from github.
https://github.com/lelazary/UV3RMod

Here is the protocol used to get into the chip and program it: A 9V is set on the reset pin (VPP) to enter programing mode.
Protocol sending over SPI LSB first. After almost every byte, the chip will pulse the data line to indicate ACK.

Get Chip ID: 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82

Program fuse bits

Get Chip ID   : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
30ms delay
Set Mode      : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for response should be 0x01
30ms delay
set 20FF to 0 : 0x55 0xAA 0x5A 0xA5 0x02 0x00 0x00 0x03 0x05 0x00 wait 1ms for response should be 0x55

Erase Chip   :
Get Chip ID   : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
30ms delay
Erase         : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x03 0x01 wait 1ms for response should be 0x55
2 sec delay
set 20FF to 0 : 0x55 0xAA 0x5A 0xA5 0x02 0x00 0x00 0x03 0x05 0x00 wait 1ms for response should be 0x55

Read Data:
Get Chip ID    : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
30ms delay30ms delay
Set Read range: 0x55 0xAA 0x5A 0xA5 0x05 0x00 0x00 0x04 0xC0 0x00 0xC0 0xFF 0x00 <wait for data to go high> read 255 bytes
30ms delay
Set Memory Mode: 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for 0x00

Program Data:
Get Chip ID                 : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
30ms delay
Set Memory Mode             : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for 0x00
30ms delay
Set program range and data  : 0x55 0xAA 0x5A 0xA5 0x80 0xC0 0x00 0x00 <128 bytes> wait 1ms for 0x55

Set Memory Mode: 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for 0x00

DIY instructions for performing this hack

Disclaimer: This hack is a work in progress. If you perform this hack you might transmit on frequencies outside the allowable amateur bands. For now I am keeping the TX amplifiers off, so the radio will not transmit more then a hundred feet. However, anyone can always go into the code and turn them back on. If you do so, you are responsible to insure that you know what you are doing, and take the necessary precaution when transmitting.  I will not be responsible for any damage cause by the radio or to the radio. Remember, once you erase the original firmware, there is no way of getting it back, so the radio will be a brick until you upload the firmware; but if you got this far, then that is exactly what you want.

For this hack you will need an arduino,  NPN transistor (I used 2n394), 1K and 10K resistors, and a 9 volt battery. You could just use a 9V battery and a 10K resistor, but you would need to manually connect the VPP to 10K -> 9V and GND. If you want to do any kind of development, then the transistor is your option.
Connect everything according to the diagram bellow:

I made a small interface with the transistor and a connector so I can plug and unplug the programmer. When the programmer is plugged in, the radio will not function. You will need to disconnect the GND,VPP and VDD for the radio to boot up normally. A connector would allow you to plug the radio for programming and unplug it for testing.

Once you have everything connected, check out the code from here:
https://github.com/lelazary/UV3RMod

Upload the arduino sketch programmer/chipFlash/chipFlash.ino into the arduino
Go into the programmer directory, connect the programmer and the +5V power supply that came with the radio and run the python script uv3rFlash.py . If you choose not to build the transistor circuit then start with the vpp connect to GND, switch it to +9V, run the command, and switch it back to GND.

./uv3rFlash.py -p /dev/ttyUSB0 -e

This will erase the chip using the arduino attached to /dev/ttyUSB0. If you are on windows then use COM5 instead of the /dev/ttyUSB0 or whichever com port the arduino is using.

Then you can run

./uv3rFlash.py -p /dev/ttyUSB0 -w ../firmware/uv3r_firmware.hex

If there are no errors, unplug the programmer, and you should have a brand new firmware on the radio

Troubleshooting:
If something is not working correctly, you can go into the arduino serial monitor program and use the raw commands to see what is going own.

//Protocol
//   CMD      Param               Description
//   S                                        Enter ISP mode
//   C                                        Exit  ISP mode
//   I                                          Get Chip ID
//   F             HH                      Flash config register with hex HH
//   E                                         Erase flash memory
//   P            AAAA LL DDDD…     Program memory with starting at address AAAA length LL and data DDDDDD (2char hex code)
//   R           SSSS EEEE           Read memory from address SSSS to EEEE
//On success return OK
//On failure return ERR

For example typing
SIC <enter>
will start the ISP mode, get the chip id and then close ISP mode. I looks like the chip id is 82, so that is what I am checking in the code. If you are not getting 00 for the id, then something is probably wrong with the connections (check the +5 and vpp).

You may also be interested in these posts on my website:

UV5R hack
http://www.liorelazary.com/index.php?option=com_content&view=article&id=49:hacking-the-baofeng-uv5r&catid=14:baofeng-uv5r&Itemid=17

TX d-start data with the UV5R and filters off.
http://www.liorelazary.com/index.php?option=com_content&view=article&id=50:txrx-digital-data-using-the-uv5r&catid=14:baofeng-uv5r&Itemid=17

Good Luck.

A reader from North Carolina, USA, wrote to me and asked the following:

A question: I am a just a general class ham. I would like to know exactly what it takes to operate on PSK. I have a TS140s, a key and a dipole at 50′. I also have a Compaq laptop computer with a sound card. Can someone tell me what I need to buy — not just in generalities — to help me get up and running with this mode?

Would those of us with some experience with PSK (definitely not me!) take a shot at answering him? If so, please reply in comments. Thanks in advance!